Black Hat USA 2024 | Greg Enriquez | RedSeal & Jesse Whaley | Amtrak

theCUBE.net

Clips
News
More from Black Hat USA 2024

Jesse Whaley

CISO

Amtrak

Greg Enriquez

CEO

RedSeal, Inc.

Amtrak taps RedSeal’s network modeling tech for critical infrastructure resilience

In today’s cybersecurity landscape, network modeling is emerging as a pivotal tool in safeguarding expanding data and network infrastructures.The challenges of asset mapping and vulnerability management are growing more complex for even the most proactive enterprises. RedSeal Inc. is stepping up to fill this critical gap, offering comprehensive solutions that provide omnichannel visibility for organizations. A prime example of this is the company’s collaboration with Amtrak, showcasing the transformative potential of advanced network modeling in the public sector.Unpacking network modeling with execs from RedSeal and Amtrak

play_circle_outline Exploring Black Hat Las Vegas with RedSeal: Enhancing Cybersecurity Through Network Modeling Technology

play_circle_outline Importance of vulnerability prioritization and risk management in cybersecurity

play_circle_outline Ten-year roadmap for Amtrak and RedSeal towards mesh architecture and integrations

play_circle_outline Protecting Critical Infrastructure: Mitigating Nation-State Threats Through Policy and Engagement

play_circle_outline Hope to have solutions for ransomware and deepfakes at next Black Hat

Info
Transcript

Greg Enriquez | RedSeal & Jesse Whaley | Amtrak

Jesse Whaley

CISO Amtrak

Greg Enriquez

CEO RedSeal, Inc.

This segment features Greg and Jesse discussing RedSeal, a network modeling technology that helps prioritize vulnerabilities for protection against hackers. Jesse, the CISO of Amtrak, explains the complexity of securing a diverse range of assets, including trains, infrastructure, and real estate. He emphasizes the importance of prioritizing risks based on safety and protection of data. Greg highlights the need for seamless integration and easy deployment of cybersecurity solutions, focusing on data accessibility and value for clients. Both discuss the evolvin... Read more

explore Keep Exploring

What is RedSeal and what are the key aspects of their network modeling technology? add

What is vulnerability prioritization and how can it help risk executives allocate resources to best protect their organization? add

What is the goal for the ten-year technological roadmap for Amtrak? add

What is the biggest risk facing the United States in terms of national-security threats to critical infrastructure? add

What are we trying to achieve with our solutions in dealing with ransomware and deepfakes, and how do we measure success in addressing these issues in the future? add

bolt Powered by CUBE AI

Greg Enriquez | RedSeal & Jesse Whaley | Amtrak

search

>> Good afternoon nerd fam and welcome back to Las Vegas Nevada. It's a Sizzler, not just because of the temps, but because of the conversations we're having here at Black Hat on theCUBE. My name's Savannah Peterson, and we're going to jump right into this segment. I am absolutely thrilled to have Greg and Jesse joining me today. Gentlemen, thank you for making this happen.

>> Hey, it's great to be here.

>> Yeah, thanks for having us.

>> I realized we pulled this off quite quickly. Last minute I met Jane on your team on my flight. Shout out to Alaska Airlines in row 12. Jane, what's up? You're a queen for making this work, but I love it. Right away when I sat down next to Jane and we were talking about RedSeal, I thought, "Whoa, wait a minute. This is a story and a product that more people need to know about." I wasn't as versed in you as I should have been. So Greg, I'm going to let you take it away and just give us a little bit of a pitch about RedSeal, and then I want to get into why Jesse is sitting here with us on stage.

>> My pleasure. Well, we're here at Black Hat where individuals are here to protect themselves and their companies and the government and the world from hackers, and you can't protect what you don't know. And RedSeal is a preeminent modeling technology to model your network so you understand all of the assets and all the access points on your network without fail. And then once you know that we want to prioritize vulnerabilities, so you do the right things at the right time. We want to assist you in understanding the attack path. So if something bad does happen, you know what they can get to right away. And then finally, we're going to assist you in continuous compliance. So we do all sorts of compliance, CIS checks, this is STIGs and we have PCI compliance, and we're going to assist you in all of those areas. So four things. We do those four things on-prem, in the cloud, in the metasphere or wherever people compute.

>> I love that. That was perfect. We'll count that as a perfect elevator pitch. So you're helping folks figure out what's going on. I thought this was interesting. On your website, there's a piece of data, 76% of executives think they have the lay of the land within their network, but when you work with them a 100% of the time, you find unexpected things.

>> Yeah, I liken it to the old Federal Express commercial, when you absolutely, positively need to know what's on the network, you go to RedSeal. So when we go in, it's almost denial. We will go through a network and identify assets that are unknown, identify paths that are unknown. We even identify passwords that people shouldn't be using, and customers are in denial often when we do that. And no, no, that's not true. That's locked down. You can't get there. Or how about your IT and your OT network? Our OT network is completely separated and segmented from our IT network. Well, often we have to share the information that that may not be the case.

>> Yeah, yeah, I can imagine that's viable. Which brings us to Jesse. Jesse CISO at Amtrak. Huge train fan girl, Amtrak fan girl over here. So I am just delighted that you could make time to join Greg and I today. What does it mean to be the CISO of Amtrak? What are you thinking about?

>> Wow, anybody can look up my background. It is the most complicated, most difficult job I've ever had.

>> And this is coming from someone who worked for the DOD and has done some crazy stuff for the Pentagon.

>> Yeah. Was all in the DOD, around the world, at the Pentagon, Nation-state attackers. That was my life, 24 by seven for quite a long time.

>> And here you're saying Amtrak is harder than that. Dig in.

>> Yeah, so it's the scope and the age and the mobility of it all. So Amtrak is not just a passenger train company. It is, right? We are America's Railroad, but beyond that, we are owners and operator of critical infrastructure, transportation being the main one, but also energy, emergency services. We have our own federalized police force, 500 police officers protecting our passengers and taking care of the physical threats. And beyond that, we are a real estate company. Think about how many stations we have, 568 stations-

>> Oh my gosh, and even just the track itself.

>> No, more than that. So we only own about a thousand miles of track, but we travel over 22,000 miles of track. So all the big class one freight railroads provide us access to their track so that we can get around the country. So that means some other things from interoperability and partnerships and third-party risk, right? It's very complicated

>> So many moving pieces.

>> And then even what most people don't know beyond that. So there's some retail in there. Of course, we take credit cards, we have website, we have a mobile apps-

>> Yeah, I love your G split

>> So we do development. And probably the biggest part of our business that people probably don't know about is we're a construction company. We're doing about $8 billion worth of construction work this year. That's Bridges-

>> 8 billion?...

>> Tunnel. Yes.

>> Casual numbers there. Yeah.

>> So I mean, the biggest projects we have, we're putting in four new tubes under the Hudson to help out with traffic in and out of the city, Manhattan. Building new bridges, tunnels, maintenance facilities. We bought well over a 100 new train sets that are being manufactured by both Siemens, which is a German manufacturer, but the manufacturer here in the US and Alstom. It's a French manufacturer building our new Acela trains here in the United States. So it's a pretty exciting time.

>> Cool. Anyone who's ever traveled on trains knows the Acela is the best. So that is very exciting.

>> There's more coming.

>> Yay. I love to hear that. Hopefully high-speed trains for us in the West here someday too.

>> Someday.

>> Yeah. One can hope. It is an election cycle. If you're listening out there, we'd love some more transport over here. How long have you two known each other, Greg?

>> So it's been a couple of years, little over... I mean Black Hat. Last year we spent time together and Jesse's been a client for many years at RedSeal, but most recently in the last couple of years.

>> Yeah. And what makes RedSeal an attractive partner for you?

>> If you think about the scope and the breadth of everything that I just mentioned about-

>> Which was a lot....

>> having trains all over the United States, infrastructure all over the place. Our real estate footprint, the operational technology, the safety systems, the electrical systems, and even just that's the stuff beyond the traditional enterprise IT, which we have all that too. Video surveillance, cameras, you name it. Absolutely everything that you think that might exist in a company's environment, it exists in Amtrak. And how do you wrap your arms around all that? How do you even know what you have? Starting from-

>> I mean, the attack path management. I'm just thinking about that as you're talking about that. Millions of pathways.

>> Yes.

>> Probably billions, depending on how you look at it.

>> And just think about any of the frameworks that people select and follow to build a strategy around, and figure out what they need to do to protect their company. All of those frameworks start with understand what you have. Having an inventory of your hardware and software, knowing what's on your network. I mean, how do you know how to protect something if you don't even know that you have it? So just mapping all of that out is a huge challenge.

>> And extensive. I mean, you're probably talking about legacy systems, you're talking about newer tech, you're talking about edge devices that consumers are using within the Amtrak app. I mean, you've got oodles of layers.

>> We have 19th and 20th century assets that we're trying to pull into the 21st century, as our CEO likes to say. Not all of that's tech, but I mean, we do have some pretty old tech out there, a lot of analog stuff that we're now transforming and making digital.

>> Yeah, that's fascinating. And what a challenge? I can see. I'm catching up with now, why you're saying this is the hardest job you've had. It's been a spicy one for you. I can tell.

>> It's hot.

>> Yeah. How does working with companies, organizations as broad as Amtrak help RedSeal develop a better product?

>> Well, I think when you look at the diversity of devices and their network, for example, we have over 125 integrations with other cybersecurity partners in the industry-

>> That's a lot....

>> which are very important to what we do. And we had to do those, some specifically for Amtrak. Think of things moving around the country and devices that have to be ruggedized on those trains and being able to track those. So when we have customers like Amtrak, expanding our connectivity, making sure that we're working with partners that they want us to work with is really important. So that's how it enhances what we connect to for the customers. Integrations are key. We as suppliers in cybersecurity need to think about integrating for our customers and not make our customers be integrators for us.

>> Yes, making that experience seamless and a consistent user experience.

>> So the better I can partner with other vendors to provide a solution for our clients, it's better for our client. And they shouldn't have to be integrators of technologies that they need as a platform in some sense, to solve the problem. So that's how it makes us better, I think. That's one reason, there's probably more.

>> Yeah. So you really a platform play in that extent. You're trying to pull all the pieces together so they can just plug in and know what's going on.

>> Plug and play. That's what we want.

>> Yeah, that's what everybody wants, right? Give me that easy button. Give me that plug and play. Tell me everything I need to know. How hard is it to prioritize risk in these environments? Because once it's been evaluated Jesse, how do you know what's the biggest risk?

>> So for me, it always comes down to life, health, safety. When you're dealing with the lives of our American citizens every day and they trust that we're going to take care of them on board our trains and that we're going to get them, deliver them safely to where they need to go. They trust that we're going to take care of the data that they've freely given to us so that we can provide the best service possible for them. So in order of priority, safety has to be number one. Amtrak has a culture of safety, and that's how I tied my cybersecurity program into that culture of safety, to make cybersecurity part of it, and it gets prioritized from there. And beyond that, we just want to make sure that we are getting everybody where they need to go and having the best possible experience that they can have.

>> Yeah, absolutely. And that's what I usually have on Amtrak. You're looking at a bunch of different companies across verticals from the government to private sector. Is it hard to help them prioritize? I can imagine everyone wants to take care of everything all at once.

>> I think the key around us is vulnerability prioritization. So when you see something that has a CVSS score of a nine and then you find out based on your RedSeal map and what you know, that that vulnerability doesn't touch anything that matters, that it's not going to affect something open to the internet or something that's affecting our critical data, then you can lower your priority. Now imagine, Jesse and many others in this business are stressed for resources. You think every day, if you put yourself in the chair of a risk executive, you wake up in the morning and you decide, how am I going to allocate resources to best protect the organization to do what needs to be done? And so if I can move some of the noise and help them prioritize vulnerabilities by understanding the map of their network and what has capabilities to get to something that could hurt us, then that helps them understand where to focus their time. Jesse said, "I got to worry about safety. I've got to worry about moving people to the right place safely." And so we're going to help them prioritize those vulnerabilities that they hear about to understand if it affects a train or a switching system or ticketing or something that may be critical to the environment.

>> And at its core, what I'm hearing from both of you, it's a lot of data. We're talking about a lot of data and a lot of different avenues in which that can be compromised or affected or impacted or even just siloed into a place where it wouldn't be the same defense mechanism it would normally be. This problem is only going to grow exponentially.

>> Yes. I mean, I think with what Greg was saying, it's really important for me to understand what the risk actually is. So just knowing that something has a vulnerability doesn't really mean anything, right? What's the likelihood of being exploited? If that's exploited, what can be exploited next? What can be compromised?

>> What's the worst case scenario?

>> What's the worst case scenario? What's the avenue of approach that a threat actor would take through your environment to get to your crown jewels or to your safety systems, or to the train management system that controls what the train's doing? That's pretty exciting stuff to be able to see that.

>> It is really exciting stuff, and I think as end users sometimes we forget how fragile these ecosystems are when a system gets compromised. We've seen a little bit of that over the last few weeks, but it can be a really systemic meltdown when something happens. So I'm glad you're there on the forefront, Jesse, keeping an eye on everything. Keeping us all safe on the train. Greg, when you look forward into the next couple of years, where are you guys going?

>> Well, I think we need to focus on the four things that we do both in the cloud and on-prem. I think the key for any technology is, how fast can I deploy it? How easy is it for my team to use it and get reports and data out of it? You just said it. Cyber security is a big data problem. It's just data related. And so having access to the data and being to share the data, so I mentioned a little bit of ITOT. I mentioned our integrations. The data that we have is very valuable. We pull configurations from all the network devices. We keep that up to date. If I can share that data with other solutions, if I can make that data available to my customers when they need it quickly, then I think that's the future. It's access to the data, being able to use the data, share the data and make it valuable to our clients. Of course, ease of use, time to value, those are critical in any solution. Because again, resources are scarce, resources are difficult to get. And if I can make the least amount of resource used to get the most benefit from the product I'm doing, I think a service to our clients.

>> I think so too. I'll affirm that. It seems like Jesse also affirms that. Jesse, what about you? What's the ten-year, well, whatever you can share with us, ten-year technological roadmap for Amtrak?

>> I think there was a lot of what Greg said that resonates with me because what we really want and what we need is more of a mesh architecture, so that we're interlocking solutions together. And we can't do that unless our partners are playing well together and taking care of those integrations for us so that Greg drops his platform in our environment. We have other solutions that we want it to be connected to and interlocked with so that we can remove the seams in our defensive posture, and have better visibility and protection for our customers and the company itself.

>> Yeah, and continue to be a trusted brand, everybody trusts Amtrak. You're in a good spot. You want to keep that up, I would imagine. What do you think is the greatest risk to our industry overall right now? Could be a conversation, could be a threat. You're closing this out, so I'm going to give you the tough questions for the day. Yeah. I can tell you don't want to go first, Greg, which is why I'm kind of just letting us sit in this moment, which is adorable. All right, Jesse, yeah.

>> So I'm in critical infrastructure, and what I think we're starting to see now, and we've been seeing a little while, is nation-state threat actors testing the boundaries of what they can do in critical infrastructure, in healthcare, in transportation, in energy, in water treatment. I mean, we've seen some boundaries being pushed there. And I think the biggest risk that United States has is if they do nothing about that, if they don't take the right stances on policies, if they don't engage the right technical resources to push back where it can be pushed back, the risk is just going to keep growing for owners and our operators of critical infrastructure, which is a danger to all of this.

>> I really agree with what you just said there, Jesse, and I think one of the conversations we've had over the course of our segments this week, is policy as a line of defense, essentially. And I think it's something that people don't think about a lot, but I think you're absolutely spot on. No one is going to protect us unless we protect ourselves and agree what protection even looks like.

>> That's right.

>> So I think that's great. All right, Greg, we've bought you enough time.

>> Well, coming from a background in incident response and dealing with nation-states, going all the way back to releasing the APT-I report and exposing the world to the fact that we are under attack by foreign governments or foreign actors, it's manifested itself in many ways. I mean, even ransomware today. Ransomware is a big problem that corporations face, nation-state actors are a big problem. They can be one and the same. I mean, ransomware is funding nation-state activity. And so I think being able to protect not only critical infrastructure, but the intellectual property, the IP and the resources of our corporations and governments in our country, I think is a big threat. But it's in every country that is in the free world dealing with this. The cost of a cyber breach today on average is about $5 million. But when you look at healthcare, it can run up to $10 million. Probably the highest cost in repairing and dealing with cyber breach is in healthcare, which is an area that may not have the resources to deal with this. So I think those level of breaches, both nation-state, and those acting in ransomware attacks are threats to us in the future. And we need to constantly keep up and stay ahead of the game in those areas.

>> Yeah, we absolutely do. The call-out to healthcare is huge, especially with even just a lapse in information or data getting skewed. It is compromised, people can die.

>> That's right.

>> Yeah, it doesn't take much. Jesse, you've been all over the world doing work for the DOD. And speaking of nation-states, Japan, Korea, are there any trends you can tell us from a geopolitical space? Is everything blending together now in this era? What's going on?

>> I don't think everything's blending together. I mean, I do think that every nation-state has their agenda, their plans and where they see themselves in the world in the future. And I think there are some nation-states that have more aggressive plans than others when it comes to where they want to see the United States in the future.

>> I would affirm that, yes.

>> And I think you can just figure out who those might be just by reading what's coming out from the government. And I think we're really at the point where we do know who our friends are and who those are that are not our friends.

>> Yeah. And I mean you know the real truth. I think perception and reality is different when you look at where attacks are coming from, which is pretty cool. Wow. Yeah, this has been super cool. Okay, I have one more question for you both. It's less hard than the last one at the least. You're fabulous guests, and we'd love to have you back, and I'm sure this is the first of many. So when we have you on, let's just call it next Black Hat, a year from now, what do you hope to be able to say then, that you can't yet say today? Greg, I'm going to give it to you first since you copped out last time.

>> I think what we want to be able to say is that we've one-upped or put together a set of solutions that are dealing with the current issues we're facing in ransomware, deepfakes. Of course, we've gotten through this interview actually, we've gotten through this whole interview without saying AI, I think.

>> I'm proud of us.

>> Is that pretty amazing?

>> Yeah.

>> That was my goal. Now you blew it. No, I'm kidding.

>> So I think when you look at what the buzz is, Black Hat right now and what people are talking about, being able to say that we have a path to success in those areas because it is a journey. It's never going to be solid success. I think a year from now to say, "Okay, that's behind us now. It's part of the process. We know that that's part of doing business. It's part of where we are. We'll move on to the next thing, because there will be one. But we want to make sure that we don't see the same issues year after year, but we're moving forward and learning from it."

>> Yeah, absolutely. Good answer. All right, Jesse, what about you?

>> Yeah, I mean, I really hope we're not talking about AI at Black Hat next year, to be honest with you. I went to-

>> I love this hot take for me, by the way. So many people wanted me talking about it. I love that you're just, when we were in the hallway, you're like, "I don't want to talk about AI." It's fabulous. Let's not.

>> But here I am-

>> There's plenty of things to talk about.

>> But here I am talking about AI, or talking about not wanting to talk about AI. I just think it's like, no enough stop more. But it is a challenge that we all need to tackle. I think it's just a part of the way that we work. Just like any other technology, I think it's going to be as ubiquitous as, "Let me Google that," It's just-

>> You're absolutely right there, I think, yeah.

>> I do think we are overthinking a little bit and perhaps we're trying to solve the wrong problems. Me personally, I think that the problem that you should be solving before trying to solve with AI is solving your data security problem, solving data security posture management. So I would definitely like to be talking about other things because there are other challenges out there that we need to be solving.

>> I like that. That was well stated. Jesse, Greg, this is a knockout session. I am so delighted that you were able to be here. I got to give another quick shout out to Jane for making this happen. Also, I want to say thank you to these beautiful production team back there grinning at me behind the camera. You don't get to see them, but they work hard every day in the sweat box to make us look fantastic. Shout out to John and the rest of theCUBE team who are back at home. And thank all of you for tuning into our two days of fantastic coverage here at Black Hat. We're in Las Vegas, Nevada, but the train is ready to leave the station and to head back to the studio. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.